fork: initialize Mycellium UI Private from Mycell-UI@5229e2c

This repo is a hard fork of mycellium-ui dedicated to the
mycelium-private experimental track upstream. The two apps coexist
on the same machine via distinct app identifiers, polkit actions,
and binary names.

Renames
- package + crate: mycellium-ui → mycellium-ui-private
- bundle identifier: tech.threefold.mycellium-ui-private
- daemon binary: mycelium-private (separate upstream release tarball)
- bootstrap wrapper: /usr/bin/mycellium-bootstrap-private
- polkit policy file + action id

Functional changes
- SidecarConfig.network_name field (UTF-8, 2..=64 bytes)
- start() refuses to spawn without a network name AND a 32-byte
  key file at app_data_dir/network_key.bin; surfaces a clear
  error rather than letting mycelium-private fail mid-startup
- network_key_status / generate / import / export / delete
  commands; uses OS RNG (rand) and writes 0600
- empty default peers list (no Threefold seed for private overlays)
- new Settings → Private network panel: name input, key generate /
  reveal-hex / import / delete, status indicator

Adapted bootstrap script kills both `mycelium` and
`mycelium-private` orphans (cross-clash on UDP/9650 + TCP/8990).

CI workflow + sidebar branding updated. The README explains the
divergence model and how to cherry-pick upstream fixes.

src-tauri/packaging/mycellium-bootstrap-private

@@ -0,0 +1,29 @@
+#!/bin/sh
+# /usr/bin/mycellium-bootstrap-private — installed by mycellium-ui-private.deb
+#
+# Wrapper around the mycelium-private daemon that guarantees a clean
+# start every time. Without this, an orphan daemon left over from a
+# previous run (which the user-space launcher cannot SIGKILL because
+# it runs as root via pkexec) would block the next start with one of:
+#
+#   * EBUSY on TUN device creation
+#   * "Address in use" on the JSON-RPC port (hardcoded 8990 in 0.6.1)
+#   * "Failed to bind multicast discovery socket" on UDP 9650
+#
+# This script runs under the same elevated context as the daemon
+# itself (single pkexec call), so polkit's auth_admin_keep caching
+# only fires one prompt per session.
+
+set -e
+
+# Best-effort cleanup. Errors ignored so the exec at the end always
+# runs even on a clean machine. We pkill both `mycelium` and
+# `mycelium-private` because the public-variant orphan would clash
+# on UDP/9650 and TCP/8990 just as readily.
+pkill -9 -x mycelium-private 2>/dev/null || true
+pkill -9 -x mycelium 2>/dev/null || true
+sleep 0.3
+ip link del mycelium 2>/dev/null || true
+ip link del mycel0 2>/dev/null || true
+
+exec /usr/bin/mycelium-private "$@"